Add "json" destination for JSON modules

This is needed for whatwg/html#9486.

Tests: web-platform-tests/wpt#41665.

fetch.bs

@@ -1749,6 +1749,7 @@ the empty string,
 "<code>frame</code>",
 "<code>iframe</code>",
 "<code>image</code>",
+"<code>json</code>",
 "<code>manifest</code>",
 "<code>object</code>",
 "<code>paintworklet</code>",
@@ -1768,7 +1769,7 @@ and "<code>webidentity</code>" as fetches with those destinations skip service w
 <!-- Dependencies:
      * CSP: https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request
      * Mixed Content
-     * Preload: https://w3c.github.io/preload/#processing
+     * Preload: https://html.spec.whatwg.org/multipage/links.html#link-type-preload
      * HTML -->
 
 <p>A <a for=/>request</a>'s <a for=request>destination</a> is
@@ -1793,7 +1794,7 @@ not always relevant and might require different behavior.
    <th>CSP directive
    <th>Features
   <tr>
-   <td rowspan=20>""
+   <td rowspan=21>""
    <td>"<code>report</code>"
    <td rowspan=2>&mdash;
    <td>CSP, NEL reports.
@@ -1864,10 +1865,14 @@ not always relevant and might require different behavior.
    <td>"<code>worker</code>"
    <td><code>child-src</code>, <code>script-src</code>, <code>worker-src</code>
    <td><code>Worker</code>
+  <tr>
+   <td>"<code>json</code>"
+   <td><code>connect-src</code>
+   <td><code>import "..." with { type: "json" }</code>
   <tr>
    <td>"<code>style</code>"
    <td><code>style-src</code>
-   <td>HTML's <code>&lt;link rel=stylesheet></code>, CSS' <code>@import</code>
+   <td>HTML's <code>&lt;link rel=stylesheet></code>, CSS' <code>@import</code>, <code>import "..." with { type: "css" }</code>
   <tr>
    <td>"<code>track</code>"
    <td><code>media-src</code>
@@ -2197,9 +2202,9 @@ bookkeeping details by the <a for=/>fetch</a> algorithm.
 
 <p>A <dfn export>subresource request</dfn> is a <a for=/>request</a>
 whose <a for=request>destination</a> is "<code>audio</code>", "<code>audioworklet</code>",
-"<code>font</code>", "<code>image</code>", "<code>manifest</code>", "<code>paintworklet</code>",
-"<code>script</code>", "<code>style</code>", "<code>track</code>", "<code>video</code>",
-"<code>xslt</code>", or the empty string.
+"<code>font</code>", "<code>image</code>", "<code>json</code>" "<code>manifest</code>",
+"<code>paintworklet</code>", "<code>script</code>", "<code>style</code>", "<code>track</code>",
+"<code>video</code>", "<code>xslt</code>", or the empty string.
 
 <p>A <dfn export>non-subresource request</dfn> is a <a for=/>request</a>
 whose <a for=request>destination</a> is "<code>document</code>", "<code>embed</code>",
@@ -4381,6 +4386,9 @@ the response. [[!HTTP-CACHING]]
      <dt>"<code>image</code>"
      <dd>`<code>image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5</code>`
 
+     <dt>"<code>json</code>"
+     <dd>`<code>application/json,*/*;q=0.5</code>`
+
      <dt>"<code>style</code>"
      <dd>`<code>text/css,*/*;q=0.1</code>`
     </dl>
@@ -7404,7 +7412,7 @@ dictionary RequestInit {
   any window; // can only be set to null
 };
 
-enum RequestDestination { "", "audio", "audioworklet", "document", "embed", "font", "frame", "iframe", "image", "manifest", "object", "paintworklet", "report", "script", "sharedworker", "style",  "track", "video", "worker", "xslt" };
+enum RequestDestination { "", "audio", "audioworklet", "document", "embed", "font", "frame", "iframe", "image", "json", "manifest", "object", "paintworklet", "report", "script", "sharedworker", "style",  "track", "video", "worker", "xslt" };
 enum RequestMode { "navigate", "same-origin", "no-cors", "cors" };
 enum RequestCredentials { "omit", "same-origin", "include" };
 enum RequestCache { "default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached" };